Transparent Computation and Correlated Equilibrium¤ Sergei Izmalkov Matt Lepinski Silvio Micali abhi shelat Abstract Achieving correlated equilibrium is an important and extensively investigated problem at the intersection of many ¯elds: in particular, game theory, cryptography and e±cient algorithms. Thus far, however, perfectly rational solutions have been lacking, and the problem has been formulated with somewhat limited objectives. In this paper, we ² Provide a stronger and more general notion of correlated-equilibrium achievement; and ² Provide more rational solutions in this more demanding framework. We obtain our game theoretic results by putting forward and exemplifying a stronger notion of secure computation. Traditionally, secure computation replaces a trusted party by multi- ple players computing on their separate shares of the data. In contrast, we directly replace a trusted party by a transparent device1 that correctly and privately evaluates any function by performing only public operations on unseen data. To construct such devices, we substantially strengthen the ballot-box techniques of [ILM05]. We demonstrate the additional power of trans- parent computation by proving that the game-theoretic results of this paper are unachievable by traditionally secure protocols. ¤This material is based upon work supported by the National Science Foundation under Grant SES-0551244. Any opinions, ¯ndings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation (NSF). 1The authors would like to thank Michael Rabin for suggesting the term. 1 Game Theoretic Background and Correlated Equilibrium Normal-Form Games. In a normal-form game G with n players, each player i has (1) his own ¯nite set of actions, Ai, and (2) his own utility function, ui, mapping the action space A = A1 £ ::: £ An into the real numbers. The action sets and the utility functions of G are common knowledge. The game is played in a single stage, without inter-player communication. Each player i can be thought of as being isolated in his own room, facing a panel of buttons: one for each action in Ai. In such a setting, i plays action ai by pushing the corresponding button, simultaneously with the other players. Letting a = (a1; : : : ; an) be the resulting outcome, each player i receives ui(a) as his payo®. A strategy σi for player i is a probability distribution over Ai. Extensive-Form Games. An extensive-form game is played in multiple stages, with the players acting one at a time. Such a game can be depicted as a tree. The root represents the start of the game; an internal node an intermediate stage of the game; and a leaf an ending of the game. To each leaf a vector of utilities of all the players is assigned. The game also speci¯es which player acts at which node, and the actions available to him. The children of a non-leaf node N correspond to the actions available to the player designated to act at node N. (Extensive-form games may also have a special player, Nature, that, when called to act, plays actions chosen according to ¯xed probability distributions commonly known to all players.) An extensive-form game is of perfect information when all the players know the exact actions played so far, and thus the current node of the tree. For such games, a strategy of a player i consists of a (possibly probabilistic) function specifying the action to take at any node where i must act. An extensive-form game is of imperfect information if the acting player is not perfectly informed about the actions played so far. Therefore, even though the tree structure of the game, the payo®s of the leaf nodes, and so on, continue to be common knowledge, the acting player no longer knows the exact node he is at. The information in his possession allows him to exclude many nodes, but is compatible with his being at one of several others. E®ectively, the nodes of the tree are partitioned into so called information sets. Two nodes belong to the same information set of player i if i cannot distinguish between them. The information sets of di®erent players are disjoint, and the game speci¯es the acting player at each information set. Rational Play. Solving a game means ¯nding the ways in which rational players can play it. A solution to a normal-form game G is a Nash equilibrium. This is a pro¯le σ = (σ1; : : : ; σn) of strategies that are self-reinforcing: that is, no player i has an incentive to deviate from his own strategy if he believes that all other players stick to their own strategies. Formally, σ is a Nash 2 equilibrium if, for all players i and for all strategies σbi, ui(σi; σ¡i) ¸ ui(σbi; σ¡i): Nash equilibria could be de¯ned syntactically in the same way for extensive-form games, but they would no longer be impeccably rational. In a normal-form game, the strategies of a Nash equilibrium σ are best responses to each other in a setting where all players act simultaneously. The players cannot see whether the others act according to their equilibrium strategies or deviate. In an extensive-form game, instead, players act over time, they may observe actions of the others inconsistent with equilibrium strategies and react accordingly. In a Nash equilibrium σ, however, σi need not be i's best response if i notices that j deviated from σj. For example, a Nash equilibrium 2 For comprehensive coverage of game-theoretic concepts see [OR97]. Following standard notation, σ¡i denotes the vector of strategies in σ for all players except i, and the utility function ui evaluated on a vector of n strategies |rather than an outcome of n actions| refers to i's expected utility, arising from the n underlying distributions. 1 concerning people properly standing in line may be supported by strategies such as \if you cut in front of the line, I will explode a grenade and kill both of us." Clearly, such empty threats should not be taken too seriously. rational player may reason \If I cut in front of you, then, when it is time for you to respond, you will act rationally and will not explode a grenade since you want to live. Thus, if I cut in front of you, I will receive a higher utility, so I will cut." The appropriate notion of rationality for extensive-form games is that of sequential rationality. Sequential rationality mandates that players act in their best interest in any situation that may possibly arise during play (and thus even at points where some players have already deviated from their equilibrium strategies). In extensive-form games with perfect information, sequential rationality is precisely captured by the notion of a Subgame-Perfect Equilibrium. A strategy pro¯le σ is a subgame-perfect equilibrium if σi is the best response for player i at any node of the game tree where i acts, provided that in the future (from that node onward) all players stick to σ. Unfortunately, no equally compelling equilibrium notions are guaranteed to exist for extensive- form games of imperfect information. For such games the most popular notion by far is that of a sequential equilibrium.3 Every game of imperfect information admits a sequential equilibrium. However, despite their name!, sequential equilibria are far from capturing sequential rationality: even Kreps himself concedes the arti¯ciality of some of its aspects. Correlated Equilibrium. As introduced by Aumann [Aum74], a correlated equilibrium for a normal-form game G is a probability distribution, E, over the action space A1 £:::£An, satisfying the following informal property. If |somehow!| (1) a pro¯le of actions (a1; : : : ; an) is chosen according to E, and (2) each player i enters in possession of ai as his \recommended" action (without gaining any other information about a¡i) then, if the other players stick to their recommendations, no single player can improve his expected payo® by replacing his recommended action by a di®erent one. Nash equilibria are thus special cases of correlated ones: a correlated equilibrium is a joint distribution over A1 £ ¢ ¢ ¢ £ An, while a Nash equilibrium is a product distribution. A Fundamental Question. Correlated equilibria enjoy two crucial properties: ² They can be e±ciently computed (see [Pap05]) |an open problem for Nash equilibria| and ² They o®er to all players payo®s at least equal and often much greater than Nash equilibria. For practical purposes, therefore, one might as well replace Nash equilibria by correlated ones. Correlated equilibria, however, have a main disadvantage over Nash ones: achieving them seems to require a lot of trust: in essence a trusted party T who ¯rst privately samples E's distribution to get an n-tuple of recommended actions (a1; : : : ; an), and then privately gives each ai to his proper recipient without revealing him any other information. Thus, a natural question arises: Can correlated equilibrium be meaningfully achieved without trusted parties? In a sense, a positive answer would \practically bypass" the problem of computing Nash equilibria. 3As de¯ned by Kreps and Wilson [KW82], sequential equilibria essentially assume a belief system ¹ specifying, for each information set is, a probability distribution ¹is over the nodes in is. (Such distributions can be interpreted as the \Bayesian implications" of the strategies the acting player believes have actually been used in reaching is.) Given such a ¹, one can compute expected payo®s from any strategy pro¯le σ at any information set. A belief system should satisfy certain technical conditions aimed at preventing that ¹ may be arbitrarily selected for the sole purpose of supporting a given strategy pro¯leσ.